SASystem v1 - Implementation of GMASO Framework

Paper Title

This project implements the model described in the paper:

"GMASO: A Graph-based Multi-Agent Security Optimizer for Threat-Specific Countermeasure Selection in Mission-Critical Systems: A Novel Approach to Security Investment Decision-Making"

Overview

SASystem v1 is the AnyLogic simulation implementation of the GMASO (Graph-based Multi-Agent Security Optimizer) framework. This project is a novel cybersecurity decision-support tool designed to enhance the selection of threat-specific countermeasures in complex, mission-critical systems.

The GMASO framework utilizes a structured graph to represent intricate relationships between missions, tasks, assets, threats, vulnerabilities, and countermeasures. By integrating a multi-agent system architecture with dynamic, CIA-weighted risk assessment and multi-criteria optimization, the model aims to provide precise security investment recommendations while balancing budgetary constraints and operational performance.

The simulation allows for the analysis of system risks, the evaluation of threat impacts, and the assessment of the effectiveness and cost of deploying various countermeasures to mitigate potential harm to mission objectives.

Designed and Implemented By

• Model Designer & Lead Implementer: Sajed Yousefi Mashhour
• AnyLogic Design Contributor: Parmida Jamgohari

Supervisors

• Dr. Motahareh Dehghan
• Dr. Babak Sadeghiyan
• Dr. Seyed Alireza Hashemi Golpayegani

Key Features of the GMASO Framework (Implemented in SASystem v1)

• Graph-Based Modeling: Represents system components (missions, tasks, assets) and security elements (threats, vulnerabilities, countermeasures) as nodes in a graph, with CIA-weighted edges defining relationships and dependencies.
• Multi-Agent System Architecture: Employs specialized agents (Control, Structural, Mission-Centric, Security-Focused) to perform distinct security functions and manage interactions within the simulated environment.
• Hierarchical & CIA-Weighted Risk Assessment: Evaluates security risks at multiple levels (Mission, Task, Asset) considering Confidentiality (C), Integrity (I), and Availability (A) dimensions, enabling dynamic propagation of impacts.
• Threat Prioritization: Identifies and prioritizes threats based on their potential impact derived from the risk assessment.
• Multi-Criteria Countermeasure Optimization: Selects optimal countermeasures by evaluating them against multiple factors including:
  • Target Threat Risk Reduction Effectiveness
  • Deployment Costs (Direct and Indirect)
  • Quality of Service (QoS) Impacts (Direct and Indirect)
  • Lateral Risk Reduction Benefits
• Dynamic Risk Mitigation & Adaptive Response: The framework supports mechanisms for adapting to changing threat landscapes and evaluating countermeasures under dynamic conditions.
• Impact Analysis: Analyzes countermeasure effectiveness through bidirectional impact propagation (backward from compromised nodes to missions, forward from countermeasures to system security).
• Configurable Parameters: Allows customization of simulation runs through parameters such as maximum budget and weights for optimization criteria. These parameters are dynamically loaded.
• Database Integration: Interacts with a database for initial configuration (e.g., clearing previous data) and outputting simulation results, including final mission risks and the selected optimal countermeasure.

Architecture

The SASystem v1 implementation follows the four sequential phases of the GMASO framework:

1. System Initialization and Graph Construction: Establishes the foundational graph structure by instantiating agents representing system components and security elements with their weighted connections.
2. Risk Assessment and Threat Prioritization: Calculates vulnerability impacts (CIA) and propagates risk through the graph hierarchy (Assets -> Tasks -> Missions) to determine and prioritize threat risks.
3. Countermeasure Optimization: Evaluates potential countermeasures using a multi-criteria utility function to select the most effective option within budget and operational constraints.
4. Impact Analysis and Risk Propagation: Recalculates risk values after countermeasure selection to quantify propagated risk reduction and assess overall security improvement.

The architecture comprises a multi-agent system featuring ten distinct agent types categorized into Control (Main Agent), Structural (Node Agent Type, Edge Agent Type), Mission-Centric (Mission Agent Type, Task Agent Type), and Security-Focused (Asset Agent Type, Threat Agent Type, Vulnerability Agent Type, Countermeasure Agent Type, Threat Risk Mitigation Agent Type).

Key internal components include:

• The Main agent orchestrating simulation flow and managing global parameters.
• Collections like nodesList, forwardEdgesList, prioritizedThreats, and activeCountermeasures to manage simulated entities.
• Variables like currentCriticalThreat and optimalCountermeasureSelected to track simulation state.
• Events like simulationStart to trigger simulation processes.
• Database views (assets_vulnerabilities_view, threats_vulnerabilities_view) are used for data retrieval.

Technology

• AnyLogic: The primary simulation modeling platform (.alp file format).
• Java: Used for implementing custom logic, agent behaviors, and database interactions within AnyLogic.
• Database: The model interacts with an external database for input configuration and output storage.

Purpose

The SASystem v1 model, based on the GMASO framework, serves as an advanced analytical and decision-support tool. It simulates complex system security scenarios to help organizations:

• Understand how cyber threats impact mission-critical systems.
• Evaluate and select effective countermeasures under resource limitations.
• Optimize security investments by balancing risk reduction, cost, and operational performance.
• Inform strategic decision-making processes related to risk mitigation and cybersecurity resource allocation.

This implementation contributes to advancing cybersecurity modeling methodologies by providing a systematic, data-driven approach to countermeasure selection in complex, interconnected environments.